# A Major Supply Chain Attack Is Targeting Open-Source Developers Through Stolen GitHub Credentials
Cybersecurity analysts have uncovered a large-scale campaign that leverages stolen credentials belonging to prominent open-source project maintainers to distribute malicious automated workflows across hundreds of code repositories. The operation, which has been active since late September, represents one of the most significant supply chain threats to the open-source ecosystem in recent years.
## How the Attack Unfolded
The campaign exploited accounts belonging to two well-known software contributors — one who maintains a widely-used game development framework and another who authored a core component of Uber’s infrastructure tooling. By gaining access to these accounts, the threat actor inserted a deceptive workflow file into each targeted repository. This file was disguised to look like a routine security check but was, in reality, designed to harvest sensitive credentials.
The first account was compromised and used to deploy the malicious workflow across 27 repositories. Hours later, the second account was weaponized to spread the same payload to over 300 additional repositories in less than 20 minutes. As of early October, security researchers have tracked the compromised workflow being pushed to more than 500 individual GitHub accounts, with the ripple effect extending into tens of thousands of associated repositories.
## What the Malicious Workflow Actually Does
Once activated, the injected workflow begins by quietly harvesting any stored secrets already present in the repository’s configuration. It then scans the entire codebase for patterns that match credentials for services like Amazon Web Services, artificial intelligence providers such as OpenAI and Anthropic, and various cloud and SaaS platforms. Crucially, it also searches through the full commit history of the project, catching credentials that may have been removed from the current code but still exist in past versions.
The stolen data — which includes API keys, tokens for container registries, database passwords, and authentication credentials for platforms like GitHub, GitLab, npm, and PyPI — is transmitted to a remote server controlled by the attacker over an unencrypted connection. This means there is no encryption protecting the exfiltrated data in transit.
The workflow is configured to trigger whenever changes are pushed to any branch or tag, and it also activates manually, ensuring broad coverage of potential execution opportunities.
## The GhostAction Campaign: A Broader Pattern
This latest wave of activity is part of a larger campaign that cybersecurity firm Socket has identified and labeled **GhostAction**. The campaign first surfaced publicly in late September 2025 and has since evolved in scale and sophistication. During its initial monitoring period, GhostAction compromised accounts belonging to 327 different GitHub users and organizations, affecting 817 repositories and stealing over 3,000 secrets spanning multiple platforms and credential types.
In certain instances, the threat actor has also modified Docker images associated with targeted projects to include cryptocurrency mining software, further demonstrating the campaign’s versatility and willingness to pursue multiple malicious objectives.
## Who Is at Risk
The attack poses a particular danger to downstream collaborators. Many open-source projects maintain forked copies of the original codebase. If a malicious workflow has been inserted into the upstream repository, every fork inherits that workflow file. In one documented case, nearly 280 forks carried the malicious file, each of which could become a new vector for credential theft whenever Actions are enabled and new code is pushed.
Private repositories are especially concerning because they tend to contain credentials that are not publicly visible, making them high-value targets for attackers who gain access through compromised maintainer accounts.
## Recommended Actions for Developers and Maintainers
Security teams have issued urgent guidance for anyone involved in open-source development:
– **Audit all repositories** for the presence of suspicious workflow files, specifically those named in patterns resembling routine security audits, particularly those introduced after late August 2026.
– **Assume compromise** if either of the identified malicious workflows is found in any repository.
– **Revoke and rotate** all exposed credentials immediately, including personal access tokens, API keys, and service-specific tokens.
– **Remove the malicious workflow** from every branch of the affected repository.
– **Inspect all forks**, including private mirrors and downstream copies, since the malicious file can persist silently in these environments.
## What This Means for the Open-Source Community
This incident highlights a persistent vulnerability in the open-source supply chain: the reliance on individual account credentials to manage and modify widely-used projects. When a single developer account is compromised, the consequences can cascade across thousands of downstream repositories and the teams and organizations that depend on them. It reinforces the need for stronger authentication practices, such as hardware security keys, mandatory multi-factor authentication, and the adoption of fine-grained access controls that limit the scope of what a single token can do.
—
## Frequently Asked Questions
**What is GhostAction?**
GhostAction is a large-scale supply chain attack campaign that targets open-source projects on GitHub by compromising maintainer accounts and injecting malicious automated workflows designed to steal credentials.
**How do attackers gain access to maintainer accounts?**
The most likely method involves the use of leaked personal access tokens harvested from infostealer malware logs or credential dumps available on underground marketplaces.
**Which platforms are affected by the stolen credentials?**
The campaign targets credentials for a wide range of services, including AWS, Google Cloud, Azure, npm, PyPI, DockerHub, GitHub, GitLab, AI providers like OpenAI and Anthropic, and communication platforms such as Slack, Telegram, and Discord.
**Can the malicious workflow be found in private repositories?**
Yes. Private forks and downstream mirrors are particularly vulnerable because they often contain sensitive credentials and can silently inherit the malicious workflow from the upstream source.
**Should I delete my repository if it has been compromised?**
Not necessarily. The recommended steps are to remove the malicious workflow from all branches, rotate every credential that may have been exposed, and audit the repository’s history for any additional signs of tampering.
**Is cryptocurrency mining also part of this campaign?**
In at least one observed case, the attackers embedded a cryptocurrency mining tool into a Docker image associated with a compromised project. However, the primary objective of the campaign appears to be credential theft.
**What can open-source maintainers do to protect themselves?**
Enable hardware-based multi-factor authentication, use fine-grained personal access tokens with minimal required permissions, regularly audit repository access logs, and monitor for unexpected changes to workflow files.
—
## Conclusion
The GhostAction campaign serves as a stark reminder of how quickly and broadly a single compromised account can ripple through the open-source ecosystem. With over 500 accounts and tens of thousands of repositories affected, the scale of this operation underscores the urgent need for stronger identity and access management practices among developers and maintainers. Organizations that depend on open-source software should also factor supply chain security into their risk assessments and ensure that any credentials exposed through compromised repositories are revoked and replaced without delay. Collective vigilance, combined with robust security tooling and authentication hardening, is essential to defending the open-source supply chain against increasingly sophisticated threats.
Thank you for reading
